697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18

Analysis

Target

697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe
Size

152KB
MD5

37656f778382768613dde3b7167327e3
SHA1

60da8746b0efe12d33a13038cdc860d927918e83
SHA256

697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18
SHA512

56bcd6cf8a00ad0cdadf9c49f33a0801d9768eff65153423c854fae6aa55859dd250046687ffbfdeef43569df311786be29c095e9ccd41dfecc7a816e16f1200

Score

8^/10

Loads dropped DLL 1 IoCs

Processes:

697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

pid process

1424 697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

pid	process
1424	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

description	pid	process	target process
PID 1424 wrote to memory of 912	1424	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe	bdif.exe
PID 1424 wrote to memory of 912	1424	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe	bdif.exe
PID 1424 wrote to memory of 912	1424	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe	bdif.exe
PID 1424 wrote to memory of 912	1424	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe	bdif.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

912 bdif.exe

pid	process
912	bdif.exe

NTFS ADS 1 IoCs

Processes:

697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

description	ioc	process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	697a4078312b404ceaa6dd072245f20b093c0272f751d9fb67d3d71ada632b18.exe

\??\c:\programdata\e6533cd889\bdif.exe
c:\programdata\e6533cd889\bdif.exe
2⤵
- Executes dropped EXE
PID:912

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

Download Submit
C:\ProgramData\e6533cd889\bdif.exe

Download Submit
\ProgramData\e6533cd889\bdif.exe

Download Submit
memory/912-3-0x0000000000000000-mapping.dmp

Download
memory/912-5-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/912-6-0x00000000002E0000-0x0000000000305000-memory.dmp

Filesize
148KB

Download
memory/1424-0-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1424-1-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download